Compared methods:  We compare with the state-of-the-art certified defense, namely Jia et al. [1]}, by extending it to multi-label classification. To the best of our knowledge, Jia et al. is the only certified defense that considers top-\(k\)  predictions against \(\ell _2\) -norm adversarial perturbations. Given an arbitrary label, Jia et al. derived a certified radius such that the label is among the top-\(k\)  labels predicted by the smoothed classifier (Theorem 1 in Jia et al.). For each label in \(L(\mathbf {x})\) , we compute a certified radius. Given a perturbation size \(R\) , the certified intersection size \(e\)  can be computed as the number of labels in \(L(\mathbf {x})\)  whose certified radii are larger than \(R\) .
